I'm looking for a pre-built solution I can use in my RoR application. I'm ideally looking for something similar to the ASP.NET Forms authentication that provides email validation, sign-up controls, and allows users to reset their passwords. Oh yeah, and easily allows me to pull the user that is currently logged into the application.

I've started to look into the already written pieces, but I've found it to be really confusing. I've looked at LoginGenerator, RestfulAuthentication, SaltedLoginGenerator, but there doesn't seem to be one place that has great tutorials or provide a comparison of them. If there's a site I just haven't discovered yet, or if there is a de-facto standard that most people use, I'd appreciate the helping hand.

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

I would really consider using authlogic as well. its a lot cleaner than restful_auth. Authlogic learned from all the previous solutions and repackaged them in a cleaner, more customizable solution
– taelorMay 17 '09 at 21:57

I took your advice and went with Authlogic, and I am really pleased. Might take a little bit longer to setup, what it is very clean and easy to understand. There is no scary piles of generated code.
– Guy CJul 17 '09 at 15:23

Yeah, it def takes longer to setup. I wish he had removed a little of the abstraction there and had it ship with things everyone needs like forgotten password, and email confirmations included. But overall, it's still pretty good.
– Brian ArmstrongJul 17 '09 at 21:46

The example project makes it super easy to get up and running. Just git clone the repository, copy in a database.yml file and you've got a fully authenticated site ready.
– Casey WatsonOct 22 '10 at 5:27

I would second this. I recently had to implement a pretty complex multi-site authentication system, which I based on top of the RestfulAuth design, providing the same API to the rest of the application as RA would, Definatly a nice clear easy to work with API with easy to read code :-)
– Laurie YoungSep 20 '08 at 16:03

I can vouch for Devise. I set it up in my app, and can says that it's easy to use, at least for me as a relative newbie. I blogged about my experience with it here: therealmattslay.blogspot.com/2010/06/…
– MattSlayJun 16 '10 at 17:03

Please don't think me terribly rude, but I think that forum entry is an example of the worst part of Restful Authentication. There are a multitude of missing features and here is a super long (and contradictory) set of steps for adding those features in one at a time. Whatever the opposite of DRY is, I'm pretty sure that's it. Only you're not repeating yourself, you're repeating hundreds of other developers to include stuff that should have been included or optional for RA from the start.
– John MunschDec 6 '09 at 5:49

Just a note, LoginGenerator and SaltedLoginGenerator have been superseded by Restful Authentication and are unsupported on newer Rails releases -- dont waste any time on them, though they were great at the time.

AuthLogic seems to be what you want for this. It's very configurable, and although it doesn't generate the code for you, it's quite easy to use. For email validation and password recovery you probably want to use the :perishable_token column. AuthLogic takes care of it, you only need to reset it when it's used. For information on how to set up a basic app, you can take a look at Ryan Bates' Railscast on AuthLogic, and the "official" example app. Ben Johnson, the creator of AuthLogic has also written a blog post on how to RESTfully reset passwords.

Unfortunately I can't post more than one link, but the links to the railscast, the password reset blog post and the example app are all in the README (see the AuthLogic repo for the README)

Update: Now I can post more links, so I linked some more. Thank you marinatime for adding the link in the meanwhile

restful_authentication is a powerful tool which is very flexible and provides most of what you are looking for out of the box. However, a couple of caveats:

Don't think in terms of 'controls'. In Rails the Model, View and Controller are much more independent than in 'Webforms-style' ASP.NET. Work out what you want from each layer independently, write tests/specs to match and make sure each layer is doing what you expect.

Even if you are using a plugin there is no substitute for reading (at least some) of the code generated. If you have a big-picture idea of what is going on under the hood, you will find debugging and customising much easier.

The plugin restful_authentication and other plugins that extend it, answer your needs perfectly. A quick search on github.com will reveal a lot of tutorials, examples, and extensitons. Just go here:
- http://github.com/search?q=restful_authentication

There are several projects that use restful_authentication just to provide examples of a bare-bones Rails app with just the authentication parts.

While the RailsCast on a bespoke auth system is great (and I've implemented a similar system multiple times), it's by no means pre-built and does not provide all of the features that a setup like Devise does.
– Colin RSep 20 '12 at 20:49

Agreed, but Devise can be quite bulky. In my opinion, much time and heart-ache can be saved by building your own auth system unless you are really going to fully take advantage of the features that Devise offers.
– Adam JonasSep 24 '12 at 17:03

2

I'm looking for a pre-built solution I can use in my RoR application.
– Colin RSep 24 '12 at 17:34